Office 365 Students Changing Their User Photos

[Fontayne56]

We have discovered our users can change their User Photo on Office 365!

 

Can anyone guide me on how to stop this please?

 

Many Thanks

Ryan

[3s-gtech]

Not worked it out yet! However, I found that clearing the thumbnailPhoto attribute in AD (which seems to sync back) cleared the photos in O365 too. Should be possible to script that to run every night.

[Boredguy]

We assigned images in AD to the thumbnailPhoto and jpegPhoto values

In 365 we created a new OWBMailboxPolicy (can be done via the Exchange admin site) and limit some of the feature there for students, but also run the following powershell command to add additional restrictions

Set-OwaMailboxPolicy -Identity Pupils -DisplayPhotosEnabled $False -SetPhotoEnabled $False -DisableFacebook $true -GroupCreationEnabled $False

 

All students have this policy applied after their account has been created, we run the script regularly and check for users that don't have a specific policy already applied.

 

Now that Teams is pulling the restrictions for photos from 365, most of our users appear to have been unable to change their picture from what we have assigned them (which is the school logo for each school in the trust)

 

(You can set the permissions on the default OWAMailboxPolicy if you choose)

Edited June 18, 2020 by Boredguy

[jthompson]

I've a feeling that this can be done by modifying the properties of relevant fields within the SharePoint stuff that handles user profiles. I can't recall the specifics but that how I locked down user profile fields like mobile number, interests, etc in Delve.

[jthompson]

Admin Center -> SharePoint -> More features -> User profiles -> Manage User Properties

 

It seems to take a while with loooong page load times, but if you're patient you should get a list of all the user profile properties, including "Picture". Click on a property name and then choose "Edit". Within the settings for each property is an option "Allow users to edit values for this property". Untick that, save, etc. and you should be set. You can also set some properties to not be shown on profile pages.

[dezt]

I ran this in Powershell ISE as admin, it also clears out the custom photos that have been uploaded by students. You need a group in Office 365 called All_Students that contains all your students, but you can do that in local Ad, sync it up using AADConnect and then delete it when you have finished.

 

Install-Module AzureAD

Import-Module AzureAD -force

$O365Cred = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $O365Cred -Authentication Basic -AllowRedirection

Import-PSSession $Session -DisableNameChecking

$sfbSession = New-CsOnlineSession -Credential $O365Cred

Import-PSSession $sfbSession

Connect-MsolService -Credential $O365Cred

Connect-AzureAD -Credential $O365Cred

$users = Get-UnifiedGroup -Identity "All_Students" | Get-UnifiedGroupLinks -LinkType Member | select Name, PrimarySmtpAddress

New-OwaMailboxPolicy -Name "Pupils"

Set-OwaMailboxPolicy -Identity "Pupils" -SetPhotoEnabled $false

foreach ($user in $users) { Set-CASMailbox -Identity $user.PrimarySmtpAddress -OwaMailboxPolicy Pupils }

foreach ($user in $users) { Remove-UserPhoto -Identity $user.PrimarySmtpAddress -Confirm:$false }